Braavolabs privacy policy

Braavolabs (com.braavolabs.mobile) is a mobile app that helps you monitor your autonomous AI workflows with a human-in-the-loop. We collect only the minimum data needed for the app to function; we never use your data for advertising or model training.

• Account information: Email, name, hashed password (Argon2id). If you sign in via a third-party SSO provider, we receive that provider's identity token.
• Application usage data: Workflows you create, run results, approval decisions and integration configurations belong to your workspace. A shared workspace may have other members; this content should not be treated as personal records belonging only to you.
• Device identifiers: Expo Push token for sending notifications. We do not collect advertising IDs.
• Crash reports: Anonymous crash stack traces via Sentry. No personally identifying information is attached.
• Purchase information: Apple App Store and Google Play receive your payment; we only see the subscription status (active/inactive/tier) and the receipt verification data.

• Apple App Store / Google Play: Processes subscription payments. We use Apple's App Store Server API and Google Play Developer API to validate receipts.
• Sentry: Crash reporting (anonymous). Only application-generated error data is sent via the DSN.
• Expo / EAS Push: Stores push tokens for notification delivery.
• Integrations you configure: Slack, GitHub, etc. — their privacy policies are independent. Your tokens are stored encrypted in your account.

Account deletion removes your user record. If you are the workspace's last member, workspace records are also deleted; if other members remain, workspace content, activity and store subscription records remain with that workspace. The deletion scope and applicable retention obligations are explained for your verified request. Subscription cancellation is a separate action.

If you suspect that a child's data is being processed, contact support@yulalab.com. We assess the request and applicable deletion or retention duties; we do not give a blanket guarantee that every record is erased immediately.

Contact support@yulalab.com to exercise your rights under Article 11 of the Turkish data protection law (KVKK). Where GDPR applies, the rights in Articles 15–22, including portability and objection, have their own statutory conditions. KVKK requests are answered as soon as possible and within 30 days; GDPR requests without undue delay and normally within one month. If a justified extension under GDPR applies, you will be informed of it and its reasons within the first month.

Communication is encrypted with TLS 1.2+. Passwords are hashed with Argon2id. Database backups are encrypted with AES-256-CBC. Third-party integration tokens are encrypted per-user.

We may update this policy from time to time. Significant changes will be announced via in-app notice and reflected in the 'Last updated' date on this page.

Data Controller: YULA Lab — Mustafa Kaan Koçak
Email: support@yulalab.com
Location: Türkiye